@open-mercato/core 0.6.8-develop.6983.1.e4f794099e → 0.6.8-develop.6985.1.fb93574faa

package/dist/modules/communication_channels/api/post/channels/connect/tenant-credentials/route.js

@@ -0,0 +1,157 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import {
+  COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID
+} from "../../../../../commands/connect-credential-channel.js";
+import { validateRouteMutationGuard } from "../../../../../lib/route-mutation-guard.js";
+const metadata = {
+  path: "/communication_channels/channels/connect/tenant-credentials",
+  POST: {
+    requireAuth: true,
+    requireFeatures: ["communication_channels.connect_tenant_channel"]
+  }
+};
+const bodySchema = z.object({
+  providerKey: z.string().min(1).max(64),
+  displayName: z.string().min(1).max(255),
+  credentials: z.record(z.string(), z.unknown()),
+  pollIntervalSeconds: z.number().int().positive().max(86400).optional()
+});
+async function POST(req) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth?.sub || !auth?.tenantId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  let body;
+  try {
+    const json = await readJsonSafe(req, null);
+    body = bodySchema.parse(json);
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : "Invalid request body" },
+      { status: 422 }
+    );
+  }
+  const container = await createRequestContainer();
+  const adapterRegistry = container.resolve("channelAdapterRegistry");
+  const adapter = adapterRegistry.get(body.providerKey);
+  if (!adapter) {
+    return NextResponse.json(
+      { error: `No adapter registered for provider '${body.providerKey}'` },
+      { status: 404 }
+    );
+  }
+  if (adapter.channelScope !== "tenant") {
+    return NextResponse.json(
+      {
+        error: "This provider connects per-user channels; use the personal channel connect flow instead.",
+        code: "provider_not_tenant_scoped"
+      },
+      { status: 400 }
+    );
+  }
+  const guard = await validateRouteMutationGuard({
+    container,
+    req,
+    auth,
+    input: {
+      resourceKind: "communication_channels.channel",
+      resourceId: `new:${body.providerKey}`,
+      operation: "create",
+      mutationPayload: {
+        providerKey: body.providerKey,
+        displayName: body.displayName,
+        pollIntervalSeconds: body.pollIntervalSeconds
+      }
+    }
+  });
+  if ("response" in guard) return guard.response;
+  const commandBus = container.resolve("commandBus");
+  const orgId = auth.orgId ?? null;
+  const input = {
+    providerKey: body.providerKey,
+    displayName: body.displayName,
+    credentials: body.credentials,
+    pollIntervalSeconds: body.pollIntervalSeconds,
+    // Tenant-wide: no owning user. The command re-derives the effective scope
+    // from the adapter, so the channel + credentials are stored with user_id NULL.
+    userId: null,
+    scope: {
+      tenantId: auth.tenantId,
+      organizationId: orgId
+    }
+  };
+  const { result } = await commandBus.execute(COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID, {
+    input,
+    ctx: {
+      container,
+      auth,
+      organizationScope: null,
+      selectedOrganizationId: orgId,
+      organizationIds: orgId ? [orgId] : null
+    }
+  });
+  if (result.status === "no_adapter") {
+    return NextResponse.json({ error: result.reason }, { status: 404 });
+  }
+  if (result.status === "wrong_scope_for_route") {
+    return NextResponse.json(
+      { error: "Unexpected per-user scope on the tenant connect route.", code: "wrong_scope_for_route" },
+      { status: 500 }
+    );
+  }
+  if (result.status === "validation_failed") {
+    return NextResponse.json(
+      {
+        error: "Credential validation failed",
+        fieldErrors: result.errors,
+        ...result.errorCodes ? { fieldErrorCodes: result.errorCodes } : {}
+      },
+      { status: 422 }
+    );
+  }
+  if (result.status === "duplicate_mailbox") {
+    return NextResponse.json(
+      {
+        error: `This mailbox is already connected via "${result.existingProviderKey}". Disconnect it there before connecting it again with a different provider.`,
+        code: "mailbox_already_connected"
+      },
+      { status: 409 }
+    );
+  }
+  await guard.afterSuccess();
+  return NextResponse.json(
+    {
+      channelId: result.channelId,
+      externalIdentifier: result.externalIdentifier
+    },
+    { status: 201 }
+  );
+}
+const openApi = {
+  tags: ["CommunicationChannels"],
+  methods: {
+    POST: {
+      summary: "Connect a tenant-wide credential-based channel (push: FCM/APNs/Expo)",
+      tags: ["CommunicationChannels"],
+      responses: [
+        { status: 201, description: "Channel connected" },
+        { status: 400, description: "Provider is not tenant-scoped" },
+        { status: 401, description: "Unauthorized" },
+        { status: 404, description: "Unknown provider" },
+        { status: 422, description: "Invalid body or credential validation failed" }
+      ]
+    }
+  }
+};
+var route_default = POST;
+export {
+  POST,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/communication_channels/api/post/channels/connect/tenant-credentials/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/communication_channels/api/post/channels/connect/tenant-credentials/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID,\n  type ConnectCredentialChannelInput,\n  type ConnectCredentialChannelResult,\n} from '../../../../../commands/connect-credential-channel'\nimport type { ChannelAdapterRegistry } from '../../../../../lib/registry'\nimport { validateRouteMutationGuard } from '../../../../../lib/route-mutation-guard'\n\nexport const metadata = {\n  path: '/communication_channels/channels/connect/tenant-credentials',\n  POST: {\n    requireAuth: true,\n    requireFeatures: ['communication_channels.connect_tenant_channel'],\n  },\n}\n\nconst bodySchema = z.object({\n  providerKey: z.string().min(1).max(64),\n  displayName: z.string().min(1).max(255),\n  credentials: z.record(z.string(), z.unknown()),\n  pollIntervalSeconds: z.number().int().positive().max(86_400).optional(),\n})\n\nexport async function POST(req: Request): Promise<Response> {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: z.infer<typeof bodySchema>\n  try {\n    const json = await readJsonSafe(req, null)\n    body = bodySchema.parse(json)\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Invalid request body' },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n\n  // Reject providers that are NOT tenant-scoped so an admin can't force a\n  // per-user provider (Gmail/IMAP) into a shared tenant-wide channel. Push\n  // providers (FCM/APNs/Expo) declare `channelScope: 'tenant'` on their adapter.\n  const adapterRegistry = container.resolve('channelAdapterRegistry') as ChannelAdapterRegistry\n  const adapter = adapterRegistry.get(body.providerKey)\n  if (!adapter) {\n    return NextResponse.json(\n      { error: `No adapter registered for provider '${body.providerKey}'` },\n      { status: 404 },\n    )\n  }\n  if (adapter.channelScope !== 'tenant') {\n    return NextResponse.json(\n      {\n        error: 'This provider connects per-user channels; use the personal channel connect flow instead.',\n        code: 'provider_not_tenant_scoped',\n      },\n      { status: 400 },\n    )\n  }\n\n  const guard = await validateRouteMutationGuard({\n    container,\n    req,\n    auth,\n    input: {\n      resourceKind: 'communication_channels.channel',\n      resourceId: `new:${body.providerKey}`,\n      operation: 'create',\n      mutationPayload: {\n        providerKey: body.providerKey,\n        displayName: body.displayName,\n        pollIntervalSeconds: body.pollIntervalSeconds,\n      },\n    },\n  })\n  if ('response' in guard) return guard.response\n\n  const commandBus = container.resolve('commandBus') as CommandBus\n  const orgId = (auth as { orgId?: string | null }).orgId ?? null\n\n  const input: ConnectCredentialChannelInput = {\n    providerKey: body.providerKey,\n    displayName: body.displayName,\n    credentials: body.credentials,\n    pollIntervalSeconds: body.pollIntervalSeconds,\n    // Tenant-wide: no owning user. The command re-derives the effective scope\n    // from the adapter, so the channel + credentials are stored with user_id NULL.\n    userId: null,\n    scope: {\n      tenantId: auth.tenantId as string,\n      organizationId: orgId,\n    },\n  }\n  const { result } = await commandBus.execute<\n    ConnectCredentialChannelInput,\n    ConnectCredentialChannelResult\n  >(COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID, {\n    input,\n    ctx: {\n      container,\n      auth: auth as never,\n      organizationScope: null,\n      selectedOrganizationId: orgId,\n      organizationIds: orgId ? [orgId] : null,\n    },\n  })\n\n  if (result.status === 'no_adapter') {\n    return NextResponse.json({ error: result.reason }, { status: 404 })\n  }\n  if (result.status === 'wrong_scope_for_route') {\n    // Unreachable in practice \u2014 this route always dispatches with userId: null \u2014\n    // but handle it so the result union narrows and the invariant is explicit.\n    return NextResponse.json(\n      { error: 'Unexpected per-user scope on the tenant connect route.', code: 'wrong_scope_for_route' },\n      { status: 500 },\n    )\n  }\n  if (result.status === 'validation_failed') {\n    // `fieldErrors` stays English for API consumers and logs; `fieldErrorCodes`\n    // lets the connect widget render a localized message per field.\n    return NextResponse.json(\n      {\n        error: 'Credential validation failed',\n        fieldErrors: result.errors,\n        ...(result.errorCodes ? { fieldErrorCodes: result.errorCodes } : {}),\n      },\n      { status: 422 },\n    )\n  }\n  if (result.status === 'duplicate_mailbox') {\n    return NextResponse.json(\n      {\n        error: `This mailbox is already connected via \"${result.existingProviderKey}\". Disconnect it there before connecting it again with a different provider.`,\n        code: 'mailbox_already_connected',\n      },\n      { status: 409 },\n    )\n  }\n  await guard.afterSuccess()\n  return NextResponse.json(\n    {\n      channelId: result.channelId,\n      externalIdentifier: result.externalIdentifier,\n    },\n    { status: 201 },\n  )\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    POST: {\n      summary: 'Connect a tenant-wide credential-based channel (push: FCM/APNs/Expo)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 201, description: 'Channel connected' },\n        { status: 400, description: 'Provider is not tenant-scoped' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 404, description: 'Unknown provider' },\n        { status: 422, description: 'Invalid body or credential validation failed' },\n      ],\n    },\n  },\n}\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,OAGK;AAEP,SAAS,kCAAkC;AAEpC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,IACb,iBAAiB,CAAC,+CAA+C;AAAA,EACnE;AACF;AAEA,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC7C,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAM,EAAE,SAAS;AACxE,CAAC;AAED,eAAsB,KAAK,KAAiC;AAC1D,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,OAAO,MAAM,aAAa,KAAK,IAAI;AACzC,WAAO,WAAW,MAAM,IAAI;AAAA,EAC9B,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,uBAAuB;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAK/C,QAAM,kBAAkB,UAAU,QAAQ,wBAAwB;AAClE,QAAM,UAAU,gBAAgB,IAAI,KAAK,WAAW;AACpD,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uCAAuC,KAAK,WAAW,IAAI;AAAA,MACpE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,MAAI,QAAQ,iBAAiB,UAAU;AACrC,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,MAAM;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,2BAA2B;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,OAAO,KAAK,WAAW;AAAA,MACnC,WAAW;AAAA,MACX,iBAAiB;AAAA,QACf,aAAa,KAAK;AAAA,QAClB,aAAa,KAAK;AAAA,QAClB,qBAAqB,KAAK;AAAA,MAC5B;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,cAAc,MAAO,QAAO,MAAM;AAEtC,QAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,QAAM,QAAS,KAAmC,SAAS;AAE3D,QAAM,QAAuC;AAAA,IAC3C,aAAa,KAAK;AAAA,IAClB,aAAa,KAAK;AAAA,IAClB,aAAa,KAAK;AAAA,IAClB,qBAAqB,KAAK;AAAA;AAAA;AAAA,IAG1B,QAAQ;AAAA,IACR,OAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,QAAM,EAAE,OAAO,IAAI,MAAM,WAAW,QAGlC,8DAA8D;AAAA,IAC9D;AAAA,IACA,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,QAAQ,CAAC,KAAK,IAAI;AAAA,IACrC;AAAA,EACF,CAAC;AAED,MAAI,OAAO,WAAW,cAAc;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpE;AACA,MAAI,OAAO,WAAW,yBAAyB;AAG7C,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,0DAA0D,MAAM,wBAAwB;AAAA,MACjG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,MAAI,OAAO,WAAW,qBAAqB;AAGzC,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,aAAa,OAAO;AAAA,QACpB,GAAI,OAAO,aAAa,EAAE,iBAAiB,OAAO,WAAW,IAAI,CAAC;AAAA,MACpE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,MAAI,OAAO,WAAW,qBAAqB;AACzC,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO,0CAA0C,OAAO,mBAAmB;AAAA,QAC3E,MAAM;AAAA,MACR;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,MAAM,aAAa;AACzB,SAAO,aAAa;AAAA,IAClB;AAAA,MACE,WAAW,OAAO;AAAA,MAClB,oBAAoB,OAAO;AAAA,IAC7B;AAAA,IACA,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,QAC5D,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,+CAA+C;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;AACA,IAAO,gBAAQ;",
+  "names": []
+}

package/dist/modules/communication_channels/backend/communication_channels/channels/page.js

@@ -15,7 +15,13 @@ function ChannelsListPage() {
   const [page, setPage] = React.useState(1);
   const [isLoading, setIsLoading] = React.useState(true);
   const [errorMessage, setErrorMessage] = React.useState(null);
+  const [reloadToken, setReloadToken] = React.useState(0);
   const pageSize = 50;
+  const reload = React.useCallback(() => setReloadToken((token) => token + 1), []);
+  const injectionContext = React.useMemo(
+    () => ({ tableId: extensionPoints.hosts.channelsTable.tableId, reload }),
+    [reload]
+  );
   React.useEffect(() => {
     let cancelled = false;
     async function load() {
@@ -50,7 +56,7 @@ function ChannelsListPage() {
     return () => {
       cancelled = true;
     };
-  }, [page, t]);
+  }, [page, reloadToken, t]);
   const columns = React.useMemo(
     () => [
       {
@@ -84,6 +90,7 @@ function ChannelsListPage() {
     {
       title: t("communication_channels.nav.title", "Communication Channels"),
       extensionTableId: extensionPoints.hosts.channelsTable.tableId,
+      injectionContext,
       columns,
       data: rows,
       isLoading,

package/dist/modules/communication_channels/backend/communication_channels/channels/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/communication_channels/backend/communication_channels/channels/page.tsx"],
-  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport { extensionPoints } from '@open-mercato/core/modules/communication_channels/extension-points'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport { Tag } from '@open-mercato/ui/primitives/tag'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\n\ntype ChannelRow = {\n  id: string\n  providerKey: string\n  channelType: string\n  displayName: string\n  externalIdentifier: string | null\n  isActive: boolean\n  capabilities: Record<string, unknown> | null\n  createdAt: string | null\n}\n\ntype ChannelListResponse = {\n  items?: ChannelRow[]\n  total?: number\n  totalPages?: number\n}\n\nexport default function ChannelsListPage() {\n  const t = useT()\n  const [rows, setRows] = React.useState<ChannelRow[]>([])\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [page, setPage] = React.useState(1)\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [errorMessage, setErrorMessage] = React.useState<string | null>(null)\n  const pageSize = 50\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      setErrorMessage(null)\n      const response = await apiCall<ChannelListResponse>(\n        `/api/communication_channels/channels?page=${page}&pageSize=${pageSize}`,\n      ).catch((err: unknown) => {\n        return {\n          ok: false,\n          result: { error: err instanceof Error ? err.message : 'Failed to load channels' },\n        }\n      })\n      if (cancelled) return\n      if (!response.ok) {\n        const errBody = response.result as { error?: string } | undefined\n        setErrorMessage(\n          errBody?.error ?? t('communication_channels.errors.loadList', 'Failed to load channels'),\n        )\n        setRows([])\n        setTotal(0)\n        setTotalPages(1)\n      } else {\n        const data = (response.result ?? {}) as ChannelListResponse\n        setRows(Array.isArray(data.items) ? data.items : [])\n        setTotal(typeof data.total === 'number' ? data.total : 0)\n        setTotalPages(typeof data.totalPages === 'number' ? data.totalPages : 1)\n      }\n      setIsLoading(false)\n    }\n    void load()\n    return () => {\n      cancelled = true\n    }\n  }, [page, t])\n\n  const columns = React.useMemo<ColumnDef<ChannelRow>[]>(\n    () => [\n      {\n        header: t('communication_channels.columns.displayName', 'Channel'),\n        accessorKey: 'displayName',\n      },\n      {\n        header: t('communication_channels.columns.provider', 'Provider'),\n        accessorKey: 'providerKey',\n      },\n      {\n        header: t('communication_channels.columns.type', 'Type'),\n        accessorKey: 'channelType',\n      },\n      {\n        header: t('communication_channels.columns.identifier', 'External ID'),\n        accessorKey: 'externalIdentifier',\n        cell: ({ row }) => row.original.externalIdentifier ?? '\u2014',\n        meta: { truncate: true, maxWidth: 240 },\n      },\n      {\n        header: t('communication_channels.columns.status', 'Status'),\n        accessorKey: 'isActive',\n        cell: ({ row }) =>\n          row.original.isActive ? (\n            <Tag variant=\"success\" dot>\n              {t('communication_channels.status.active', 'Active')}\n            </Tag>\n          ) : (\n            <Tag variant=\"neutral\">\n              {t('communication_channels.status.inactive', 'Inactive')}\n            </Tag>\n          ),\n      },\n    ],\n    [t],\n  )\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable<ChannelRow>\n          title={t('communication_channels.nav.title', 'Communication Channels')}\n          extensionTableId={extensionPoints.hosts.channelsTable.tableId}\n          columns={columns}\n          data={rows}\n          isLoading={isLoading}\n          error={errorMessage}\n          emptyState={t(\n            'communication_channels.emptyState',\n            'No shared channels yet. This page lists shared, tenant-wide channels. Your personal email mailbox is private \u2014 connect and manage it under Profile \u2192 Communication Channels.',\n          )}\n          pagination={{\n            page,\n            pageSize,\n            total,\n            totalPages,\n            onPageChange: setPage,\n          }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
-  "mappings": ";AAmGY;AAjGZ,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAEhC,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAC1B,SAAS,WAAW;AACpB,SAAS,eAAe;AACxB,SAAS,YAAY;AAmBN,SAAR,mBAAoC;AACzC,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAuB,CAAC,CAAC;AACvD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAwB,IAAI;AAC1E,QAAM,WAAW;AAEjB,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,sBAAgB,IAAI;AACpB,YAAM,WAAW,MAAM;AAAA,QACrB,6CAA6C,IAAI,aAAa,QAAQ;AAAA,MACxE,EAAE,MAAM,CAAC,QAAiB;AACxB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,0BAA0B;AAAA,QAClF;AAAA,MACF,CAAC;AACD,UAAI,UAAW;AACf,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,UAAU,SAAS;AACzB;AAAA,UACE,SAAS,SAAS,EAAE,0CAA0C,yBAAyB;AAAA,QACzF;AACA,gBAAQ,CAAC,CAAC;AACV,iBAAS,CAAC;AACV,sBAAc,CAAC;AAAA,MACjB,OAAO;AACL,cAAM,OAAQ,SAAS,UAAU,CAAC;AAClC,gBAAQ,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,CAAC;AACnD,iBAAS,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,CAAC;AACxD,sBAAc,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa,CAAC;AAAA,MACzE;AACA,mBAAa,KAAK;AAAA,IACpB;AACA,SAAK,KAAK;AACV,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,MAAM,CAAC,CAAC;AAEZ,QAAM,UAAU,MAAM;AAAA,IACpB,MAAM;AAAA,MACJ;AAAA,QACE,QAAQ,EAAE,8CAA8C,SAAS;AAAA,QACjE,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,2CAA2C,UAAU;AAAA,QAC/D,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,uCAAuC,MAAM;AAAA,QACvD,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,6CAA6C,aAAa;AAAA,QACpE,aAAa;AAAA,QACb,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,SAAS,sBAAsB;AAAA,QACtD,MAAM,EAAE,UAAU,MAAM,UAAU,IAAI;AAAA,MACxC;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,yCAAyC,QAAQ;AAAA,QAC3D,aAAa;AAAA,QACb,MAAM,CAAC,EAAE,IAAI,MACX,IAAI,SAAS,WACX,oBAAC,OAAI,SAAQ,WAAU,KAAG,MACvB,YAAE,wCAAwC,QAAQ,GACrD,IAEA,oBAAC,OAAI,SAAQ,WACV,YAAE,0CAA0C,UAAU,GACzD;AAAA,MAEN;AAAA,IACF;AAAA,IACA,CAAC,CAAC;AAAA,EACJ;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,oCAAoC,wBAAwB;AAAA,MACrE,kBAAkB,gBAAgB,MAAM,cAAc;AAAA,MACtD;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,MACA,YAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA;AAAA,EACF,GACF,GACF;AAEJ;",
+  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport { extensionPoints } from '@open-mercato/core/modules/communication_channels/extension-points'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport { Tag } from '@open-mercato/ui/primitives/tag'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\n\ntype ChannelRow = {\n  id: string\n  providerKey: string\n  channelType: string\n  displayName: string\n  externalIdentifier: string | null\n  isActive: boolean\n  capabilities: Record<string, unknown> | null\n  createdAt: string | null\n}\n\ntype ChannelListResponse = {\n  items?: ChannelRow[]\n  total?: number\n  totalPages?: number\n}\n\nexport default function ChannelsListPage() {\n  const t = useT()\n  const [rows, setRows] = React.useState<ChannelRow[]>([])\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [page, setPage] = React.useState(1)\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [errorMessage, setErrorMessage] = React.useState<string | null>(null)\n  // Bumped by injected connect widgets (FCM/APNs/Expo) so a freshly connected\n  // tenant-wide channel appears without a manual page reload.\n  const [reloadToken, setReloadToken] = React.useState(0)\n  const pageSize = 50\n\n  const reload = React.useCallback(() => setReloadToken((token) => token + 1), [])\n  const injectionContext = React.useMemo(\n    () => ({ tableId: extensionPoints.hosts.channelsTable.tableId, reload }),\n    [reload],\n  )\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      setErrorMessage(null)\n      const response = await apiCall<ChannelListResponse>(\n        `/api/communication_channels/channels?page=${page}&pageSize=${pageSize}`,\n      ).catch((err: unknown) => {\n        return {\n          ok: false,\n          result: { error: err instanceof Error ? err.message : 'Failed to load channels' },\n        }\n      })\n      if (cancelled) return\n      if (!response.ok) {\n        const errBody = response.result as { error?: string } | undefined\n        setErrorMessage(\n          errBody?.error ?? t('communication_channels.errors.loadList', 'Failed to load channels'),\n        )\n        setRows([])\n        setTotal(0)\n        setTotalPages(1)\n      } else {\n        const data = (response.result ?? {}) as ChannelListResponse\n        setRows(Array.isArray(data.items) ? data.items : [])\n        setTotal(typeof data.total === 'number' ? data.total : 0)\n        setTotalPages(typeof data.totalPages === 'number' ? data.totalPages : 1)\n      }\n      setIsLoading(false)\n    }\n    void load()\n    return () => {\n      cancelled = true\n    }\n  }, [page, reloadToken, t])\n\n  const columns = React.useMemo<ColumnDef<ChannelRow>[]>(\n    () => [\n      {\n        header: t('communication_channels.columns.displayName', 'Channel'),\n        accessorKey: 'displayName',\n      },\n      {\n        header: t('communication_channels.columns.provider', 'Provider'),\n        accessorKey: 'providerKey',\n      },\n      {\n        header: t('communication_channels.columns.type', 'Type'),\n        accessorKey: 'channelType',\n      },\n      {\n        header: t('communication_channels.columns.identifier', 'External ID'),\n        accessorKey: 'externalIdentifier',\n        cell: ({ row }) => row.original.externalIdentifier ?? '\u2014',\n        meta: { truncate: true, maxWidth: 240 },\n      },\n      {\n        header: t('communication_channels.columns.status', 'Status'),\n        accessorKey: 'isActive',\n        cell: ({ row }) =>\n          row.original.isActive ? (\n            <Tag variant=\"success\" dot>\n              {t('communication_channels.status.active', 'Active')}\n            </Tag>\n          ) : (\n            <Tag variant=\"neutral\">\n              {t('communication_channels.status.inactive', 'Inactive')}\n            </Tag>\n          ),\n      },\n    ],\n    [t],\n  )\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable<ChannelRow>\n          title={t('communication_channels.nav.title', 'Communication Channels')}\n          extensionTableId={extensionPoints.hosts.channelsTable.tableId}\n          injectionContext={injectionContext}\n          columns={columns}\n          data={rows}\n          isLoading={isLoading}\n          error={errorMessage}\n          emptyState={t(\n            'communication_channels.emptyState',\n            'No shared channels yet. This page lists shared, tenant-wide channels. Your personal email mailbox is private \u2014 connect and manage it under Profile \u2192 Communication Channels.',\n          )}\n          pagination={{\n            page,\n            pageSize,\n            total,\n            totalPages,\n            onPageChange: setPage,\n          }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": ";AA4GY;AA1GZ,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAEhC,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAC1B,SAAS,WAAW;AACpB,SAAS,eAAe;AACxB,SAAS,YAAY;AAmBN,SAAR,mBAAoC;AACzC,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAuB,CAAC,CAAC;AACvD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAwB,IAAI;AAG1E,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AACtD,QAAM,WAAW;AAEjB,QAAM,SAAS,MAAM,YAAY,MAAM,eAAe,CAAC,UAAU,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC/E,QAAM,mBAAmB,MAAM;AAAA,IAC7B,OAAO,EAAE,SAAS,gBAAgB,MAAM,cAAc,SAAS,OAAO;AAAA,IACtE,CAAC,MAAM;AAAA,EACT;AAEA,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,sBAAgB,IAAI;AACpB,YAAM,WAAW,MAAM;AAAA,QACrB,6CAA6C,IAAI,aAAa,QAAQ;AAAA,MACxE,EAAE,MAAM,CAAC,QAAiB;AACxB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,0BAA0B;AAAA,QAClF;AAAA,MACF,CAAC;AACD,UAAI,UAAW;AACf,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,UAAU,SAAS;AACzB;AAAA,UACE,SAAS,SAAS,EAAE,0CAA0C,yBAAyB;AAAA,QACzF;AACA,gBAAQ,CAAC,CAAC;AACV,iBAAS,CAAC;AACV,sBAAc,CAAC;AAAA,MACjB,OAAO;AACL,cAAM,OAAQ,SAAS,UAAU,CAAC;AAClC,gBAAQ,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,CAAC;AACnD,iBAAS,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,CAAC;AACxD,sBAAc,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa,CAAC;AAAA,MACzE;AACA,mBAAa,KAAK;AAAA,IACpB;AACA,SAAK,KAAK;AACV,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,MAAM,aAAa,CAAC,CAAC;AAEzB,QAAM,UAAU,MAAM;AAAA,IACpB,MAAM;AAAA,MACJ;AAAA,QACE,QAAQ,EAAE,8CAA8C,SAAS;AAAA,QACjE,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,2CAA2C,UAAU;AAAA,QAC/D,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,uCAAuC,MAAM;AAAA,QACvD,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,6CAA6C,aAAa;AAAA,QACpE,aAAa;AAAA,QACb,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,SAAS,sBAAsB;AAAA,QACtD,MAAM,EAAE,UAAU,MAAM,UAAU,IAAI;AAAA,MACxC;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,yCAAyC,QAAQ;AAAA,QAC3D,aAAa;AAAA,QACb,MAAM,CAAC,EAAE,IAAI,MACX,IAAI,SAAS,WACX,oBAAC,OAAI,SAAQ,WAAU,KAAG,MACvB,YAAE,wCAAwC,QAAQ,GACrD,IAEA,oBAAC,OAAI,SAAQ,WACV,YAAE,0CAA0C,UAAU,GACzD;AAAA,MAEN;AAAA,IACF;AAAA,IACA,CAAC,CAAC;AAAA,EACJ;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,oCAAoC,wBAAwB;AAAA,MACrE,kBAAkB,gBAAgB,MAAM,cAAc;AAAA,MACtD;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,MACA,YAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA;AAAA,EACF,GACF,GACF;AAEJ;",
   "names": []
 }

package/dist/modules/communication_channels/commands/admin-delete-channel.js

@@ -0,0 +1,141 @@
+import { z } from "zod";
+import { registerCommand } from "@open-mercato/shared/lib/commands";
+import { extractUndoPayload as extractSharedUndoPayload } from "@open-mercato/shared/lib/commands/undo";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { CommunicationChannel } from "../data/entities.js";
+import { channelOrgScopeWhere } from "../lib/access-control.js";
+import { pushUnregister } from "./push-unregister.js";
+import { emitCommunicationChannelsEvent } from "../events.js";
+const logger = createLogger("communication_channels");
+const adminDeleteChannelSchema = z.object({
+  channelId: z.string().uuid(),
+  scope: z.object({
+    tenantId: z.string().uuid(),
+    organizationId: z.string().uuid().nullable()
+  })
+});
+const COMMUNICATION_CHANNELS_ADMIN_DELETE_CHANNEL_COMMAND_ID = "communication_channels.channel.admin_delete";
+const adminDeleteChannelCommand = {
+  id: COMMUNICATION_CHANNELS_ADMIN_DELETE_CHANNEL_COMMAND_ID,
+  // Explicitly undoable (the bus also infers this from `undo` below, but
+  // declaring it keeps undoability from silently dropping under a refactor).
+  isUndoable: true,
+  async execute(rawInput, ctx) {
+    const input = adminDeleteChannelSchema.parse(rawInput);
+    const em = ctx.container.resolve("em").fork();
+    const dscope = {
+      tenantId: input.scope.tenantId,
+      organizationId: input.scope.organizationId ?? null
+    };
+    const channel = await findOneWithDecryption(
+      em,
+      CommunicationChannel,
+      {
+        id: input.channelId,
+        tenantId: input.scope.tenantId,
+        ...channelOrgScopeWhere(input.scope.organizationId),
+        deletedAt: null
+      },
+      void 0,
+      dscope
+    );
+    if (!channel) {
+      return { status: "noop", reason: "channel not found" };
+    }
+    if (channel.userId != null) {
+      return {
+        status: "not_tenant_wide",
+        reason: "channel is a per-user channel; use the owner delete path"
+      };
+    }
+    if (channel.credentialsRef) {
+      const channelOrganizationId = channel.organizationId ?? input.scope.tenantId;
+      try {
+        await pushUnregister({
+          container: ctx.container,
+          scope: {
+            tenantId: input.scope.tenantId,
+            organizationId: channelOrganizationId,
+            userId: channel.userId ?? null
+          },
+          input: { channelId: channel.id }
+        });
+      } catch (err) {
+        logger.warn("admin-delete-channel push unregister failed", { channelId: channel.id, err });
+      }
+    }
+    channel.deletedAt = /* @__PURE__ */ new Date();
+    channel.isPrimary = false;
+    await em.flush();
+    await emitCommunicationChannelsEvent(
+      "communication_channels.channel.deleted",
+      {
+        channelId: channel.id,
+        userId: channel.userId ?? null,
+        providerKey: channel.providerKey,
+        channelType: channel.channelType,
+        tenantId: input.scope.tenantId,
+        organizationId: channel.organizationId ?? null
+      },
+      { persistent: true }
+    );
+    return {
+      status: "deleted",
+      channelId: channel.id,
+      undo: { channelId: channel.id, tenantId: channel.tenantId }
+    };
+  },
+  // Persist the undo snapshot into the action log. Without this, the command bus
+  // mints an undo token (so the UI offers "Undo") but the snapshot returned from
+  // execute() is never stored, and undo() (which clears deleted_at) would no-op.
+  async buildLog({ input, result }) {
+    if (result.status !== "deleted") return null;
+    return {
+      resourceKind: "communication_channels.channel",
+      resourceId: result.channelId,
+      tenantId: result.undo.tenantId ?? input.scope.tenantId,
+      organizationId: input.scope.organizationId ?? null,
+      payload: { undo: result.undo }
+    };
+  },
+  async undo({ ctx, logEntry }) {
+    const snapshot = extractSnapshotFromLog(logEntry);
+    if (!snapshot || !snapshot.tenantId) return;
+    const em = ctx.container.resolve("em").fork();
+    const channel = await findOneWithDecryption(
+      em,
+      CommunicationChannel,
+      { id: snapshot.channelId, tenantId: snapshot.tenantId },
+      void 0,
+      { tenantId: snapshot.tenantId, organizationId: null }
+    );
+    if (!channel) return;
+    channel.deletedAt = null;
+    await em.flush();
+  }
+};
+function extractUndoPayload(value) {
+  if (!value || typeof value !== "object") return null;
+  const candidate = value.undo ?? value;
+  if (!candidate || typeof candidate !== "object") return null;
+  const obj = candidate;
+  if (typeof obj.channelId !== "string") return null;
+  return {
+    channelId: obj.channelId,
+    tenantId: typeof obj.tenantId === "string" ? obj.tenantId : void 0
+  };
+}
+function extractSnapshotFromLog(logEntry) {
+  const undo = extractSharedUndoPayload(logEntry ?? null);
+  if (undo) return extractUndoPayload(undo);
+  return extractUndoPayload(logEntry);
+}
+registerCommand(adminDeleteChannelCommand);
+var admin_delete_channel_default = adminDeleteChannelCommand;
+export {
+  COMMUNICATION_CHANNELS_ADMIN_DELETE_CHANNEL_COMMAND_ID,
+  admin_delete_channel_default as default,
+  extractUndoPayload
+};
+//# sourceMappingURL=admin-delete-channel.js.map

package/dist/modules/communication_channels/commands/admin-delete-channel.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/commands/admin-delete-channel.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { extractUndoPayload as extractSharedUndoPayload } from '@open-mercato/shared/lib/commands/undo'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CommunicationChannel } from '../data/entities'\nimport { channelOrgScopeWhere } from '../lib/access-control'\nimport { pushUnregister } from './push-unregister'\nimport { emitCommunicationChannelsEvent } from '../events'\n\nconst logger = createLogger('communication_channels')\n\nconst adminDeleteChannelSchema = z.object({\n  channelId: z.string().uuid(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n})\n\nexport type AdminDeleteChannelInput = z.infer<typeof adminDeleteChannelSchema>\n\nexport type AdminDeleteChannelResult =\n  | { status: 'deleted'; channelId: string; undo: AdminDeleteChannelUndoSnapshot }\n  | { status: 'noop'; reason: string }\n  | { status: 'not_tenant_wide'; reason: string }\n\nexport interface AdminDeleteChannelUndoSnapshot {\n  channelId: string\n  // Optional only for back-compat with any pre-existing log entries; new\n  // snapshots always set it so the undo lookup stays tenant-scoped.\n  tenantId?: string\n}\n\nexport const COMMUNICATION_CHANNELS_ADMIN_DELETE_CHANNEL_COMMAND_ID =\n  'communication_channels.channel.admin_delete'\n\n/**\n * Admin soft-delete for a TENANT-WIDE channel (`user_id IS NULL`) \u2014 the\n * companion to `delete-channel.ts` (owner-only, per-user path). Tenant-wide\n * channels (shared inboxes and the push providers FCM/APNs/Expo) have no owner,\n * so the owner path rejects them as `not_owner`; this path deletes them under\n * the `communication_channels.admin` feature.\n *\n * The channel is loaded org-agnostically (tenant-wide push channels store\n * `organization_id IS NULL`, but shared inboxes may pin an org) via\n * `channelOrgScopeWhere`, so it resolves from any session org in the tenant.\n * Per-user channels are refused with `not_tenant_wide` \u2014 they MUST go through\n * the owner path so personal-mailbox privacy holds.\n *\n * Provider-side push delivery is torn down best-effort BEFORE the soft-delete,\n * keyed on the CHANNEL's own org (`channel.organizationId ?? tenantId`) so\n * credentials resolve where they were written (see push-register.ts /\n * connect-credential-channel.ts). Mirrors `delete-channel`'s teardown.\n *\n * Undoable: undo clears `deleted_at` to restore the row. Parity with\n * `delete-channel` \u2014 same event, payload, buildLog, and undo shape.\n */\nconst adminDeleteChannelCommand: CommandHandler<\n  AdminDeleteChannelInput,\n  AdminDeleteChannelResult\n> = {\n  id: COMMUNICATION_CHANNELS_ADMIN_DELETE_CHANNEL_COMMAND_ID,\n  // Explicitly undoable (the bus also infers this from `undo` below, but\n  // declaring it keeps undoability from silently dropping under a refactor).\n  isUndoable: true,\n  async execute(rawInput, ctx) {\n    const input = adminDeleteChannelSchema.parse(rawInput) as AdminDeleteChannelInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: input.channelId,\n        tenantId: input.scope.tenantId,\n        ...channelOrgScopeWhere(input.scope.organizationId),\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      return { status: 'noop', reason: 'channel not found' }\n    }\n    if (channel.userId != null) {\n      return {\n        status: 'not_tenant_wide',\n        reason: 'channel is a per-user channel; use the owner delete path',\n      }\n    }\n\n    // Tear down provider-side push delivery before the soft-delete, while\n    // credentials are still resolvable. Keyed on the channel's OWN org (push\n    // channels store credentials at `organization_id = tenantId`; shared inboxes\n    // at their pinned org). Best-effort \u2014 failures are logged inside\n    // pushUnregister and never re-raised.\n    if (channel.credentialsRef) {\n      const channelOrganizationId = channel.organizationId ?? input.scope.tenantId\n      try {\n        await pushUnregister({\n          container: ctx.container,\n          scope: {\n            tenantId: input.scope.tenantId,\n            organizationId: channelOrganizationId,\n            userId: channel.userId ?? null,\n          },\n          input: { channelId: channel.id },\n        })\n      } catch (err) {\n        logger.warn('admin-delete-channel push unregister failed', { channelId: channel.id, err })\n      }\n    }\n\n    channel.deletedAt = new Date()\n    channel.isPrimary = false\n    await em.flush()\n\n    // Emit AFTER flush so subscribers observe the committed soft-delete. Same\n    // event/payload shape as delete-channel so workflows/audit observe the full\n    // channel lifecycle. Persistent so the delivery can retry on failure.\n    await emitCommunicationChannelsEvent(\n      'communication_channels.channel.deleted',\n      {\n        channelId: channel.id,\n        userId: channel.userId ?? null,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        tenantId: input.scope.tenantId,\n        organizationId: channel.organizationId ?? null,\n      },\n      { persistent: true },\n    )\n\n    return {\n      status: 'deleted',\n      channelId: channel.id,\n      undo: { channelId: channel.id, tenantId: channel.tenantId },\n    }\n  },\n  // Persist the undo snapshot into the action log. Without this, the command bus\n  // mints an undo token (so the UI offers \"Undo\") but the snapshot returned from\n  // execute() is never stored, and undo() (which clears deleted_at) would no-op.\n  async buildLog({ input, result }) {\n    if (result.status !== 'deleted') return null\n    return {\n      resourceKind: 'communication_channels.channel',\n      resourceId: result.channelId,\n      tenantId: result.undo.tenantId ?? input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n      payload: { undo: result.undo },\n    }\n  },\n  async undo({ ctx, logEntry }) {\n    const snapshot = extractSnapshotFromLog(logEntry)\n    if (!snapshot || !snapshot.tenantId) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    // Re-find WITHOUT the `deletedAt: null` filter \u2014 the row we are restoring is\n    // soft-deleted. Tenant-scoped to avoid cross-tenant resolution by bare id.\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      { id: snapshot.channelId, tenantId: snapshot.tenantId },\n      undefined,\n      { tenantId: snapshot.tenantId, organizationId: null },\n    )\n    if (!channel) return\n    channel.deletedAt = null\n    await em.flush()\n  },\n}\n\n/**\n * Defensive shape-validator for the delete snapshot \u2014 mirrors the helper in\n * `delete-channel.ts` so tests can construct snapshots directly.\n */\nexport function extractUndoPayload(value: unknown): AdminDeleteChannelUndoSnapshot | null {\n  if (!value || typeof value !== 'object') return null\n  const candidate = (value as { undo?: unknown; channelId?: unknown }).undo ?? value\n  if (!candidate || typeof candidate !== 'object') return null\n  const obj = candidate as Record<string, unknown>\n  if (typeof obj.channelId !== 'string') return null\n  return {\n    channelId: obj.channelId,\n    tenantId: typeof obj.tenantId === 'string' ? obj.tenantId : undefined,\n  }\n}\n\nfunction extractSnapshotFromLog(logEntry: unknown): AdminDeleteChannelUndoSnapshot | null {\n  const undo = extractSharedUndoPayload<AdminDeleteChannelUndoSnapshot>((logEntry ?? null) as never)\n  if (undo) return extractUndoPayload(undo)\n  return extractUndoPayload(logEntry)\n}\n\nregisterCommand(adminDeleteChannelCommand)\n\nexport default adminDeleteChannelCommand\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,sBAAsB,gCAAgC;AAC/D,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC,SAAS,4BAA4B;AACrC,SAAS,4BAA4B;AACrC,SAAS,sBAAsB;AAC/B,SAAS,sCAAsC;AAE/C,MAAM,SAAS,aAAa,wBAAwB;AAEpD,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AACH,CAAC;AAgBM,MAAM,yDACX;AAuBF,MAAM,4BAGF;AAAA,EACF,IAAI;AAAA;AAAA;AAAA,EAGJ,YAAY;AAAA,EACZ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,yBAAyB,MAAM,QAAQ;AACrD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,GAAG,qBAAqB,MAAM,MAAM,cAAc;AAAA,QAClD,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,QAAQ,QAAQ,QAAQ,oBAAoB;AAAA,IACvD;AACA,QAAI,QAAQ,UAAU,MAAM;AAC1B,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF;AAOA,QAAI,QAAQ,gBAAgB;AAC1B,YAAM,wBAAwB,QAAQ,kBAAkB,MAAM,MAAM;AACpE,UAAI;AACF,cAAM,eAAe;AAAA,UACnB,WAAW,IAAI;AAAA,UACf,OAAO;AAAA,YACL,UAAU,MAAM,MAAM;AAAA,YACtB,gBAAgB;AAAA,YAChB,QAAQ,QAAQ,UAAU;AAAA,UAC5B;AAAA,UACA,OAAO,EAAE,WAAW,QAAQ,GAAG;AAAA,QACjC,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,eAAO,KAAK,+CAA+C,EAAE,WAAW,QAAQ,IAAI,IAAI,CAAC;AAAA,MAC3F;AAAA,IACF;AAEA,YAAQ,YAAY,oBAAI,KAAK;AAC7B,YAAQ,YAAY;AACpB,UAAM,GAAG,MAAM;AAKf,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,QAAQ,QAAQ,UAAU;AAAA,QAC1B,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC5C;AAAA,MACA,EAAE,YAAY,KAAK;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,QAAQ;AAAA,MACnB,MAAM,EAAE,WAAW,QAAQ,IAAI,UAAU,QAAQ,SAAS;AAAA,IAC5D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAIA,MAAM,SAAS,EAAE,OAAO,OAAO,GAAG;AAChC,QAAI,OAAO,WAAW,UAAW,QAAO;AACxC,WAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO,KAAK,YAAY,MAAM,MAAM;AAAA,MAC9C,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAC9C,SAAS,EAAE,MAAM,OAAO,KAAK;AAAA,IAC/B;AAAA,EACF;AAAA,EACA,MAAM,KAAK,EAAE,KAAK,SAAS,GAAG;AAC5B,UAAM,WAAW,uBAAuB,QAAQ;AAChD,QAAI,CAAC,YAAY,CAAC,SAAS,SAAU;AACrC,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAG/D,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,WAAW,UAAU,SAAS,SAAS;AAAA,MACtD;AAAA,MACA,EAAE,UAAU,SAAS,UAAU,gBAAgB,KAAK;AAAA,IACtD;AACA,QAAI,CAAC,QAAS;AACd,YAAQ,YAAY;AACpB,UAAM,GAAG,MAAM;AAAA,EACjB;AACF;AAMO,SAAS,mBAAmB,OAAuD;AACxF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,YAAa,MAAkD,QAAQ;AAC7E,MAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO;AACxD,QAAM,MAAM;AACZ,MAAI,OAAO,IAAI,cAAc,SAAU,QAAO;AAC9C,SAAO;AAAA,IACL,WAAW,IAAI;AAAA,IACf,UAAU,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAAA,EAC9D;AACF;AAEA,SAAS,uBAAuB,UAA0D;AACxF,QAAM,OAAO,yBAA0D,YAAY,IAAc;AACjG,MAAI,KAAM,QAAO,mBAAmB,IAAI;AACxC,SAAO,mBAAmB,QAAQ;AACpC;AAEA,gBAAgB,yBAAyB;AAEzC,IAAO,+BAAQ;",
+  "names": []
+}

package/dist/modules/communication_channels/commands/connect-credential-channel.js

@@ -10,7 +10,12 @@ const connectCredentialChannelSchema = z.object({
   credentials: z.record(z.string(), z.unknown()),
   /** Optional polling interval (seconds) — set when adapter is polling-based. */
   pollIntervalSeconds: z.number().int().positive().max(86400).optional(),
-  userId: z.string().uuid(),
+  /**
+   * Connecting user. `null` for tenant-wide (admin-connected) channels whose
+   * provider declares `channelScope: 'tenant'` (push: FCM/APNs/Expo) — the
+   * resulting channel + credentials are stored with `user_id = NULL`.
+   */
+  userId: z.string().uuid().nullable(),
   scope: z.object({
     tenantId: z.string().uuid(),
     organizationId: z.string().uuid().nullable()
@@ -30,6 +35,11 @@ const connectCredentialChannelCommand = {
         reason: `No adapter registered for provider '${input.providerKey}'`
       };
     }
+    const tenantScoped = adapter.channelScope === "tenant";
+    if (tenantScoped && input.userId !== null) {
+      return { status: "wrong_scope_for_route", providerKey: input.providerKey };
+    }
+    const effectiveUserId = tenantScoped ? null : input.userId;
     if (typeof adapter.validateCredentials === "function") {
       const validation = await adapter.validateCredentials({
         providerKey: input.providerKey,
@@ -42,7 +52,8 @@ const connectCredentialChannelCommand = {
       if (!validation.ok) {
         return {
           status: "validation_failed",
-          errors: validation.errors ?? { _form: "Credential validation failed" }
+          errors: validation.errors ?? { _form: "Credential validation failed" },
+          errorCodes: validation.errorCodes
         };
       }
     }
@@ -54,8 +65,8 @@ const connectCredentialChannelCommand = {
     }
     const credentialsScope = {
       tenantId: input.scope.tenantId,
-      organizationId: input.scope.organizationId ?? input.scope.tenantId,
-      userId: input.userId
+      organizationId: tenantScoped ? input.scope.tenantId : input.scope.organizationId ?? input.scope.tenantId,
+      userId: effectiveUserId
     };
     let credentialsRefId = null;
     let credentialsPersisted = false;
@@ -63,7 +74,7 @@ const connectCredentialChannelCommand = {
       try {
         await credentialsService.save(
           `channel_${input.providerKey}`,
-          { ...input.credentials, userId: input.userId },
+          { ...input.credentials, ...effectiveUserId ? { userId: effectiveUserId } : {} },
           credentialsScope
         );
         credentialsPersisted = true;
@@ -106,8 +117,14 @@ const connectCredentialChannelCommand = {
         displayName: input.displayName,
         externalIdentifier,
         credentialsRefId,
-        userId: input.userId,
-        scope: { tenantId: input.scope.tenantId, organizationId: input.scope.organizationId ?? null },
+        userId: effectiveUserId,
+        // Tenant-wide channels store `organization_id = NULL` (truly tenant-scoped,
+        // matching the entity's `user_id NULL` semantics) so the org-agnostic heal
+        // key stays stable across orgs and delivery reads creds at `?? tenantId`.
+        scope: {
+          tenantId: input.scope.tenantId,
+          organizationId: tenantScoped ? null : input.scope.organizationId ?? null
+        },
         pollIntervalSeconds: input.pollIntervalSeconds
       });
     } catch (err) {
@@ -120,7 +137,7 @@ const connectCredentialChannelCommand = {
       }
       throw err;
     }
-    if (credentialsAvailable && input.providerKey === "gmail") {
+    if (credentialsAvailable && input.providerKey === "gmail" && input.userId) {
       const adapterSupportsPush = typeof adapter.registerPush === "function" && typeof adapter.unregisterPush === "function";
       const organizationId = input.scope.organizationId;
       if (adapterSupportsPush && organizationId) {

package/dist/modules/communication_channels/commands/connect-credential-channel.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/commands/connect-credential-channel.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport { createConnectedChannelRow, MailboxAlreadyConnectedError } from '../lib/connect-channel'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'connect-credential-channel' })\n\nconst connectCredentialChannelSchema = z.object({\n  providerKey: z.string().min(1).max(64),\n  displayName: z.string().min(1).max(255),\n  /** Provider-specific credential fields \u2014 opaque to the hub; the adapter validates. */\n  credentials: z.record(z.string(), z.unknown()),\n  /** Optional polling interval (seconds) \u2014 set when adapter is polling-based. */\n  pollIntervalSeconds: z.number().int().positive().max(86_400).optional(),\n  userId: z.string().uuid(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n})\n\nexport type ConnectCredentialChannelInput = z.infer<typeof connectCredentialChannelSchema>\n\nexport type ConnectCredentialChannelResult =\n  | { status: 'connected'; channelId: string; externalIdentifier: string | null }\n  | { status: 'validation_failed'; errors: Record<string, string> }\n  | { status: 'no_adapter'; reason: string }\n  | { status: 'duplicate_mailbox'; externalIdentifier: string; existingProviderKey: string }\n\nexport const COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID =\n  'communication_channels.channel.connect_credential'\n\ntype CredentialsServiceLike = {\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<string | void>\n}\n\n/**\n * Connect a per-user credential-based channel (IMAP, and future basic-auth providers).\n *\n * Flow:\n *   1. Resolve the adapter for `providerKey`.\n *   2. Call `adapter.validateCredentials?` \u2014 adapters that don't implement it\n *      are accepted optimistically (the hub trusts the adapter to fail on first\n *      use). Adapters with the method return field-level errors via Zod-like\n *      `{ ok: false, errors: { fieldName: 'message' } }`; we forward those to\n *      the caller for `createCrudFormError`.\n *   3. Persist the credentials encrypted via `integrationCredentialsService.save?` if available.\n *   4. Create the `CommunicationChannel` row with `userId = currentUser.id`,\n *      `status = 'connected'`, and the adapter's declared capabilities snapshot.\n *\n * The route handler binds the `userId` field from the authenticated session;\n * the command refuses inputs whose `userId` doesn't pass UUID validation.\n */\nconst connectCredentialChannelCommand: CommandHandler<\n  ConnectCredentialChannelInput,\n  ConnectCredentialChannelResult\n> = {\n  id: COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID,\n  async execute(rawInput, ctx) {\n    const input = connectCredentialChannelSchema.parse(rawInput) as ConnectCredentialChannelInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const adapterRegistry = ctx.container.resolve('channelAdapterRegistry') as ChannelAdapterRegistry\n    const adapter = adapterRegistry.get(input.providerKey)\n    if (!adapter) {\n      return {\n        status: 'no_adapter',\n        reason: `No adapter registered for provider '${input.providerKey}'`,\n      }\n    }\n\n    // Optional credential validation.\n    if (typeof adapter.validateCredentials === 'function') {\n      const validation = await adapter.validateCredentials({\n        providerKey: input.providerKey,\n        credentials: input.credentials,\n        scope: {\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? input.scope.tenantId,\n        },\n      })\n      if (!validation.ok) {\n        return {\n          status: 'validation_failed',\n          errors: validation.errors ?? { _form: 'Credential validation failed' },\n        }\n      }\n    }\n\n    // Persist credentials best-effort.\n    let credentialsService: CredentialsServiceLike | null = null\n    try {\n      credentialsService = ctx.container.resolve('integrationCredentialsService') as CredentialsServiceLike\n    } catch {\n      credentialsService = null\n    }\n    // Arg order MUST be (integrationId, credentials, scope) \u2014 matches the real\n    // CredentialsService signature. The legacy reversed order swapped the scope\n    // object into the credentials field; see review C1 (2026-05-26).\n    //\n    // `scope.userId` is set so the credentials service writes a per-user row.\n    // Without this, two users on the same tenant share one credentials row\n    // (see review R2-C1 / N1, 2026-05-26).\n    const credentialsScope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? input.scope.tenantId,\n      userId: input.userId,\n    }\n    let credentialsRefId: string | null = null\n    let credentialsPersisted = false\n    if (credentialsService?.save) {\n      try {\n        await credentialsService.save(\n          `channel_${input.providerKey}`,\n          { ...input.credentials, userId: input.userId },\n          credentialsScope,\n        )\n        credentialsPersisted = true\n      } catch (err) {\n        logger.warn('credentials persist failed for provider', { providerKey: input.providerKey, err })\n      }\n      // Resolve the saved row id so we can link channel.credentialsRef. Best-effort.\n      if (credentialsPersisted) {\n        try {\n          const { IntegrationCredentials } = await import(\n            '@open-mercato/core/modules/integrations/data/entities'\n          )\n          const { findOneWithDecryption } = await import(\n            '@open-mercato/shared/lib/encryption/find'\n          )\n          const row = await findOneWithDecryption(\n            em,\n            IntegrationCredentials,\n            {\n              integrationId: `channel_${input.providerKey}`,\n              tenantId: credentialsScope.tenantId,\n              organizationId: credentialsScope.organizationId,\n              userId: credentialsScope.userId,\n              deletedAt: null,\n            },\n            undefined,\n            credentialsScope,\n          )\n          credentialsRefId = (row as { id?: string } | null)?.id ?? null\n        } catch {\n          credentialsRefId = null\n        }\n      }\n    }\n\n    // Mailbox identity for this channel: the email address. IMAP/SMTP credentials\n    // carry it as `fromAddress`; other credential providers may use `username` or\n    // `email`. Normalize emails to lowercase so the cross-provider duplicate guard\n    // and the per-(tenant,user,provider,mailbox) heal index match canonically.\n    const credBag = input.credentials as Record<string, unknown>\n    const rawIdentifier =\n      (typeof credBag.username === 'string' && credBag.username.length > 0 ? credBag.username : null) ??\n      (typeof credBag.email === 'string' && credBag.email.length > 0 ? credBag.email : null) ??\n      (typeof credBag.fromAddress === 'string' && credBag.fromAddress.length > 0\n        ? credBag.fromAddress\n        : null)\n    const externalIdentifier =\n      rawIdentifier && rawIdentifier.includes('@') ? rawIdentifier.toLowerCase() : rawIdentifier\n\n    // Fail-safe: if credentials persistence failed (no `credentialsRef`), the\n    // channel is created in `requires_reauth` + isActive=false so workers\n    // don't poll a channel that has no usable credentials. The user can\n    // reconnect to recover (see review R2-H4 / F6, 2026-05-26).\n    const credentialsAvailable = credentialsRefId !== null\n    let channel\n    try {\n      channel = await createConnectedChannelRow({\n        em,\n        adapter,\n        providerKey: input.providerKey,\n        displayName: input.displayName,\n        externalIdentifier,\n        credentialsRefId,\n        userId: input.userId,\n        scope: { tenantId: input.scope.tenantId, organizationId: input.scope.organizationId ?? null },\n        pollIntervalSeconds: input.pollIntervalSeconds,\n      })\n    } catch (err) {\n      // Same mailbox already connected via another provider \u2014 reject so we don't\n      // create a second channel that double-ingests every message.\n      if (err instanceof MailboxAlreadyConnectedError) {\n        return {\n          status: 'duplicate_mailbox',\n          externalIdentifier: err.externalIdentifier,\n          existingProviderKey: err.existingProviderKey,\n        }\n      }\n      throw err\n    }\n\n    // Spec C \u00A7 Phase C5 \u2014 best-effort push registration for providers that\n    // support it (Gmail). Failures persist as `pushStatus='failed'`\n    // on the channel state but do NOT fail the connect \u2014 polling fallback\n    // covers the channel until the operator clicks \"Re-register push\".\n    // Imported lazily to avoid a circular module load (push-register reads\n    // the channel adapter registry, which is initialised after this module).\n    if (credentialsAvailable && input.providerKey === 'gmail') {\n      const adapterSupportsPush =\n        typeof adapter.registerPush === 'function' && typeof adapter.unregisterPush === 'function'\n      const organizationId = input.scope.organizationId\n      if (adapterSupportsPush && organizationId) {\n        try {\n          const { pushRegister } = await import('./push-register')\n          await pushRegister({\n            container: ctx.container,\n            scope: {\n              tenantId: input.scope.tenantId,\n              organizationId,\n              userId: input.userId,\n            },\n            input: { channelId: channel.id },\n          })\n        } catch (err) {\n          // Never fail the connect on push errors \u2014 operator can manually\n          // re-register via the dedicated route. Log + continue.\n          logger.warn('best-effort pushRegister failed for channel', { channelId: channel.id, err })\n        }\n      }\n    }\n\n    return { status: 'connected', channelId: channel.id, externalIdentifier }\n  },\n}\n\nregisterCommand(connectCredentialChannelCommand)\n\nexport default connectCredentialChannelCommand\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAEhC,SAAS,2BAA2B,oCAAoC;AACxE,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,6BAA6B,CAAC;AAEvG,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA;AAAA,EAEtC,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA;AAAA,EAE7C,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAM,EAAE,SAAS;AAAA,EACtE,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AACH,CAAC;AAUM,MAAM,+DACX;AA2BF,MAAM,kCAGF;AAAA,EACF,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,+BAA+B,MAAM,QAAQ;AAC3D,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,kBAAkB,IAAI,UAAU,QAAQ,wBAAwB;AACtE,UAAM,UAAU,gBAAgB,IAAI,MAAM,WAAW;AACrD,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ,uCAAuC,MAAM,WAAW;AAAA,MAClE;AAAA,IACF;AAGA,QAAI,OAAO,QAAQ,wBAAwB,YAAY;AACrD,YAAM,aAAa,MAAM,QAAQ,oBAAoB;AAAA,QACnD,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB,OAAO;AAAA,UACL,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,QAC5D;AAAA,MACF,CAAC;AACD,UAAI,CAAC,WAAW,IAAI;AAClB,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,QAAQ,WAAW,UAAU,EAAE,OAAO,+BAA+B;AAAA,QACvE;AAAA,MACF;AAAA,IACF;AAGA,QAAI,qBAAoD;AACxD,QAAI;AACF,2BAAqB,IAAI,UAAU,QAAQ,+BAA+B;AAAA,IAC5E,QAAQ;AACN,2BAAqB;AAAA,IACvB;AAQA,UAAM,mBAAmB;AAAA,MACvB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,MAC1D,QAAQ,MAAM;AAAA,IAChB;AACA,QAAI,mBAAkC;AACtC,QAAI,uBAAuB;AAC3B,QAAI,oBAAoB,MAAM;AAC5B,UAAI;AACF,cAAM,mBAAmB;AAAA,UACvB,WAAW,MAAM,WAAW;AAAA,UAC5B,EAAE,GAAG,MAAM,aAAa,QAAQ,MAAM,OAAO;AAAA,UAC7C;AAAA,QACF;AACA,+BAAuB;AAAA,MACzB,SAAS,KAAK;AACZ,eAAO,KAAK,2CAA2C,EAAE,aAAa,MAAM,aAAa,IAAI,CAAC;AAAA,MAChG;AAEA,UAAI,sBAAsB;AACxB,YAAI;AACF,gBAAM,EAAE,uBAAuB,IAAI,MAAM,OACvC,uDACF;AACA,gBAAM,EAAE,sBAAsB,IAAI,MAAM,OACtC,0CACF;AACA,gBAAM,MAAM,MAAM;AAAA,YAChB;AAAA,YACA;AAAA,YACA;AAAA,cACE,eAAe,WAAW,MAAM,WAAW;AAAA,cAC3C,UAAU,iBAAiB;AAAA,cAC3B,gBAAgB,iBAAiB;AAAA,cACjC,QAAQ,iBAAiB;AAAA,cACzB,WAAW;AAAA,YACb;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,6BAAoB,KAAgC,MAAM;AAAA,QAC5D,QAAQ;AACN,6BAAmB;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAMA,UAAM,UAAU,MAAM;AACtB,UAAM,iBACH,OAAO,QAAQ,aAAa,YAAY,QAAQ,SAAS,SAAS,IAAI,QAAQ,WAAW,UACzF,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,SAAS,IAAI,QAAQ,QAAQ,UAChF,OAAO,QAAQ,gBAAgB,YAAY,QAAQ,YAAY,SAAS,IACrE,QAAQ,cACR;AACN,UAAM,qBACJ,iBAAiB,cAAc,SAAS,GAAG,IAAI,cAAc,YAAY,IAAI;AAM/E,UAAM,uBAAuB,qBAAqB;AAClD,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,0BAA0B;AAAA,QACxC;AAAA,QACA;AAAA,QACA,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,OAAO,EAAE,UAAU,MAAM,MAAM,UAAU,gBAAgB,MAAM,MAAM,kBAAkB,KAAK;AAAA,QAC5F,qBAAqB,MAAM;AAAA,MAC7B,CAAC;AAAA,IACH,SAAS,KAAK;AAGZ,UAAI,eAAe,8BAA8B;AAC/C,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,oBAAoB,IAAI;AAAA,UACxB,qBAAqB,IAAI;AAAA,QAC3B;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAQA,QAAI,wBAAwB,MAAM,gBAAgB,SAAS;AACzD,YAAM,sBACJ,OAAO,QAAQ,iBAAiB,cAAc,OAAO,QAAQ,mBAAmB;AAClF,YAAM,iBAAiB,MAAM,MAAM;AACnC,UAAI,uBAAuB,gBAAgB;AACzC,YAAI;AACF,gBAAM,EAAE,aAAa,IAAI,MAAM,OAAO,iBAAiB;AACvD,gBAAM,aAAa;AAAA,YACjB,WAAW,IAAI;AAAA,YACf,OAAO;AAAA,cACL,UAAU,MAAM,MAAM;AAAA,cACtB;AAAA,cACA,QAAQ,MAAM;AAAA,YAChB;AAAA,YACA,OAAO,EAAE,WAAW,QAAQ,GAAG;AAAA,UACjC,CAAC;AAAA,QACH,SAAS,KAAK;AAGZ,iBAAO,KAAK,+CAA+C,EAAE,WAAW,QAAQ,IAAI,IAAI,CAAC;AAAA,QAC3F;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,QAAQ,aAAa,WAAW,QAAQ,IAAI,mBAAmB;AAAA,EAC1E;AACF;AAEA,gBAAgB,+BAA+B;AAE/C,IAAO,qCAAQ;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport { createConnectedChannelRow, MailboxAlreadyConnectedError } from '../lib/connect-channel'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'connect-credential-channel' })\n\nconst connectCredentialChannelSchema = z.object({\n  providerKey: z.string().min(1).max(64),\n  displayName: z.string().min(1).max(255),\n  /** Provider-specific credential fields \u2014 opaque to the hub; the adapter validates. */\n  credentials: z.record(z.string(), z.unknown()),\n  /** Optional polling interval (seconds) \u2014 set when adapter is polling-based. */\n  pollIntervalSeconds: z.number().int().positive().max(86_400).optional(),\n  /**\n   * Connecting user. `null` for tenant-wide (admin-connected) channels whose\n   * provider declares `channelScope: 'tenant'` (push: FCM/APNs/Expo) \u2014 the\n   * resulting channel + credentials are stored with `user_id = NULL`.\n   */\n  userId: z.string().uuid().nullable(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n})\n\nexport type ConnectCredentialChannelInput = z.infer<typeof connectCredentialChannelSchema>\n\nexport type ConnectCredentialChannelResult =\n  | { status: 'connected'; channelId: string; externalIdentifier: string | null }\n  | { status: 'validation_failed'; errors: Record<string, string>; errorCodes?: Record<string, string> }\n  | { status: 'no_adapter'; reason: string }\n  | { status: 'duplicate_mailbox'; externalIdentifier: string; existingProviderKey: string }\n  | { status: 'wrong_scope_for_route'; providerKey: string }\n\nexport const COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID =\n  'communication_channels.channel.connect_credential'\n\ntype CredentialsServiceLike = {\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<string | void>\n}\n\n/**\n * Connect a credential-based channel (IMAP, push providers, and future basic-auth\n * providers).\n *\n * Flow:\n *   1. Resolve the adapter for `providerKey`.\n *   2. Decide scope: `adapter.channelScope === 'tenant'` \u2192 the channel + credentials\n *      are stored with `user_id = NULL` (one shared channel per tenant, e.g. push\n *      FCM/APNs/Expo); otherwise they are stored under the connecting `userId`.\n *   3. Call `adapter.validateCredentials?` \u2014 adapters that don't implement it\n *      are accepted optimistically (the hub trusts the adapter to fail on first\n *      use). Adapters with the method return field-level errors via Zod-like\n *      `{ ok: false, errors: { fieldName: 'message' } }`; we forward those to\n *      the caller for `createCrudFormError`.\n *   4. Persist the credentials encrypted via `integrationCredentialsService.save?` if available.\n *   5. Create the `CommunicationChannel` row with the effective `userId`,\n *      `status = 'connected'`, and the adapter's declared capabilities snapshot.\n *\n * The per-user route binds `userId` from the authenticated session; the tenant\n * route passes `userId: null`. Either way the command re-derives the effective\n * scope from the adapter, so a tenant provider is never stamped per-user.\n */\nconst connectCredentialChannelCommand: CommandHandler<\n  ConnectCredentialChannelInput,\n  ConnectCredentialChannelResult\n> = {\n  id: COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID,\n  async execute(rawInput, ctx) {\n    const input = connectCredentialChannelSchema.parse(rawInput) as ConnectCredentialChannelInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const adapterRegistry = ctx.container.resolve('channelAdapterRegistry') as ChannelAdapterRegistry\n    const adapter = adapterRegistry.get(input.providerKey)\n    if (!adapter) {\n      return {\n        status: 'no_adapter',\n        reason: `No adapter registered for provider '${input.providerKey}'`,\n      }\n    }\n\n    // Tenant-wide providers (push: FCM/APNs/Expo) store one shared channel +\n    // credential row per tenant with `user_id = NULL`; per-user providers\n    // (Gmail/IMAP) keep the connecting user's id.\n    //\n    // SECURITY: a tenant-scoped provider must only be connected through the\n    // admin-gated tenant route (which passes `userId: null`). If it arrives with\n    // a non-null `userId` it came from the per-user route (feature\n    // `connect_user_channel`, granted to manager/employee) \u2014 refuse rather than\n    // silently minting a privileged tenant-wide channel that bypasses the\n    // admin-only `connect_tenant_channel` gate. The tenant route passes\n    // `userId: null`, so legitimate tenant connects still pass.\n    const tenantScoped = adapter.channelScope === 'tenant'\n    if (tenantScoped && input.userId !== null) {\n      return { status: 'wrong_scope_for_route', providerKey: input.providerKey }\n    }\n    const effectiveUserId = tenantScoped ? null : input.userId\n\n    // Optional credential validation.\n    if (typeof adapter.validateCredentials === 'function') {\n      const validation = await adapter.validateCredentials({\n        providerKey: input.providerKey,\n        credentials: input.credentials,\n        scope: {\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? input.scope.tenantId,\n        },\n      })\n      if (!validation.ok) {\n        return {\n          status: 'validation_failed',\n          errors: validation.errors ?? { _form: 'Credential validation failed' },\n          errorCodes: validation.errorCodes,\n        }\n      }\n    }\n\n    // Persist credentials best-effort.\n    let credentialsService: CredentialsServiceLike | null = null\n    try {\n      credentialsService = ctx.container.resolve('integrationCredentialsService') as CredentialsServiceLike\n    } catch {\n      credentialsService = null\n    }\n    // Arg order MUST be (integrationId, credentials, scope) \u2014 matches the real\n    // CredentialsService signature. The legacy reversed order swapped the scope\n    // object into the credentials field; see review C1 (2026-05-26).\n    //\n    // `scope.userId` is set so the credentials service writes a per-user row.\n    // Without this, two users on the same tenant share one credentials row\n    // (see review R2-C1 / N1, 2026-05-26). Tenant-wide providers pass `null`\n    // here so the service writes/reads the shared `user_id = NULL` row (same\n    // pattern as Stripe/Akeneo tenant-wide credentials).\n    //\n    // `organizationId` for tenant scope is pinned to `tenantId` (not the\n    // connecting admin's selected org). The channel dedup/heal is org-agnostic\n    // (index + heal key ignore org) and the channel row is stored with\n    // `organization_id = NULL`, so push-delivery resolves credentials at\n    // `channel.organizationId ?? tenantId` = `tenantId`. Pinning the write to the\n    // same key keeps a cross-org reconnect (e.g. key rotation from another org)\n    // overwriting the one credential row the delivery path actually reads, rather\n    // than orphaning it under a per-org key.\n    const credentialsScope = {\n      tenantId: input.scope.tenantId,\n      organizationId: tenantScoped\n        ? input.scope.tenantId\n        : input.scope.organizationId ?? input.scope.tenantId,\n      userId: effectiveUserId,\n    }\n    let credentialsRefId: string | null = null\n    let credentialsPersisted = false\n    if (credentialsService?.save) {\n      try {\n        await credentialsService.save(\n          `channel_${input.providerKey}`,\n          { ...input.credentials, ...(effectiveUserId ? { userId: effectiveUserId } : {}) },\n          credentialsScope,\n        )\n        credentialsPersisted = true\n      } catch (err) {\n        logger.warn('credentials persist failed for provider', { providerKey: input.providerKey, err })\n      }\n      // Resolve the saved row id so we can link channel.credentialsRef. Best-effort.\n      if (credentialsPersisted) {\n        try {\n          const { IntegrationCredentials } = await import(\n            '@open-mercato/core/modules/integrations/data/entities'\n          )\n          const { findOneWithDecryption } = await import(\n            '@open-mercato/shared/lib/encryption/find'\n          )\n          const row = await findOneWithDecryption(\n            em,\n            IntegrationCredentials,\n            {\n              integrationId: `channel_${input.providerKey}`,\n              tenantId: credentialsScope.tenantId,\n              organizationId: credentialsScope.organizationId,\n              userId: credentialsScope.userId,\n              deletedAt: null,\n            },\n            undefined,\n            credentialsScope,\n          )\n          credentialsRefId = (row as { id?: string } | null)?.id ?? null\n        } catch {\n          credentialsRefId = null\n        }\n      }\n    }\n\n    // Mailbox identity for this channel: the email address. IMAP/SMTP credentials\n    // carry it as `fromAddress`; other credential providers may use `username` or\n    // `email`. Normalize emails to lowercase so the cross-provider duplicate guard\n    // and the per-(tenant,user,provider,mailbox) heal index match canonically.\n    const credBag = input.credentials as Record<string, unknown>\n    const rawIdentifier =\n      (typeof credBag.username === 'string' && credBag.username.length > 0 ? credBag.username : null) ??\n      (typeof credBag.email === 'string' && credBag.email.length > 0 ? credBag.email : null) ??\n      (typeof credBag.fromAddress === 'string' && credBag.fromAddress.length > 0\n        ? credBag.fromAddress\n        : null)\n    const externalIdentifier =\n      rawIdentifier && rawIdentifier.includes('@') ? rawIdentifier.toLowerCase() : rawIdentifier\n\n    // Fail-safe: if credentials persistence failed (no `credentialsRef`), the\n    // channel is created in `requires_reauth` + isActive=false so workers\n    // don't poll a channel that has no usable credentials. The user can\n    // reconnect to recover (see review R2-H4 / F6, 2026-05-26).\n    const credentialsAvailable = credentialsRefId !== null\n    let channel\n    try {\n      channel = await createConnectedChannelRow({\n        em,\n        adapter,\n        providerKey: input.providerKey,\n        displayName: input.displayName,\n        externalIdentifier,\n        credentialsRefId,\n        userId: effectiveUserId,\n        // Tenant-wide channels store `organization_id = NULL` (truly tenant-scoped,\n        // matching the entity's `user_id NULL` semantics) so the org-agnostic heal\n        // key stays stable across orgs and delivery reads creds at `?? tenantId`.\n        scope: {\n          tenantId: input.scope.tenantId,\n          organizationId: tenantScoped ? null : input.scope.organizationId ?? null,\n        },\n        pollIntervalSeconds: input.pollIntervalSeconds,\n      })\n    } catch (err) {\n      // Same mailbox already connected via another provider \u2014 reject so we don't\n      // create a second channel that double-ingests every message.\n      if (err instanceof MailboxAlreadyConnectedError) {\n        return {\n          status: 'duplicate_mailbox',\n          externalIdentifier: err.externalIdentifier,\n          existingProviderKey: err.existingProviderKey,\n        }\n      }\n      throw err\n    }\n\n    // Spec C \u00A7 Phase C5 \u2014 best-effort push registration for providers that\n    // support it (Gmail). Failures persist as `pushStatus='failed'`\n    // on the channel state but do NOT fail the connect \u2014 polling fallback\n    // covers the channel until the operator clicks \"Re-register push\".\n    // Imported lazily to avoid a circular module load (push-register reads\n    // the channel adapter registry, which is initialised after this module).\n    if (credentialsAvailable && input.providerKey === 'gmail' && input.userId) {\n      const adapterSupportsPush =\n        typeof adapter.registerPush === 'function' && typeof adapter.unregisterPush === 'function'\n      const organizationId = input.scope.organizationId\n      if (adapterSupportsPush && organizationId) {\n        try {\n          const { pushRegister } = await import('./push-register')\n          await pushRegister({\n            container: ctx.container,\n            scope: {\n              tenantId: input.scope.tenantId,\n              organizationId,\n              userId: input.userId,\n            },\n            input: { channelId: channel.id },\n          })\n        } catch (err) {\n          // Never fail the connect on push errors \u2014 operator can manually\n          // re-register via the dedicated route. Log + continue.\n          logger.warn('best-effort pushRegister failed for channel', { channelId: channel.id, err })\n        }\n      }\n    }\n\n    return { status: 'connected', channelId: channel.id, externalIdentifier }\n  },\n}\n\nregisterCommand(connectCredentialChannelCommand)\n\nexport default connectCredentialChannelCommand\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAEhC,SAAS,2BAA2B,oCAAoC;AACxE,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,6BAA6B,CAAC;AAEvG,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA;AAAA,EAEtC,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA;AAAA,EAE7C,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAM,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AACH,CAAC;AAWM,MAAM,+DACX;AAgCF,MAAM,kCAGF;AAAA,EACF,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,+BAA+B,MAAM,QAAQ;AAC3D,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,kBAAkB,IAAI,UAAU,QAAQ,wBAAwB;AACtE,UAAM,UAAU,gBAAgB,IAAI,MAAM,WAAW;AACrD,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ,uCAAuC,MAAM,WAAW;AAAA,MAClE;AAAA,IACF;AAaA,UAAM,eAAe,QAAQ,iBAAiB;AAC9C,QAAI,gBAAgB,MAAM,WAAW,MAAM;AACzC,aAAO,EAAE,QAAQ,yBAAyB,aAAa,MAAM,YAAY;AAAA,IAC3E;AACA,UAAM,kBAAkB,eAAe,OAAO,MAAM;AAGpD,QAAI,OAAO,QAAQ,wBAAwB,YAAY;AACrD,YAAM,aAAa,MAAM,QAAQ,oBAAoB;AAAA,QACnD,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB,OAAO;AAAA,UACL,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,QAC5D;AAAA,MACF,CAAC;AACD,UAAI,CAAC,WAAW,IAAI;AAClB,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,QAAQ,WAAW,UAAU,EAAE,OAAO,+BAA+B;AAAA,UACrE,YAAY,WAAW;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AAGA,QAAI,qBAAoD;AACxD,QAAI;AACF,2BAAqB,IAAI,UAAU,QAAQ,+BAA+B;AAAA,IAC5E,QAAQ;AACN,2BAAqB;AAAA,IACvB;AAmBA,UAAM,mBAAmB;AAAA,MACvB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,eACZ,MAAM,MAAM,WACZ,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,MAC9C,QAAQ;AAAA,IACV;AACA,QAAI,mBAAkC;AACtC,QAAI,uBAAuB;AAC3B,QAAI,oBAAoB,MAAM;AAC5B,UAAI;AACF,cAAM,mBAAmB;AAAA,UACvB,WAAW,MAAM,WAAW;AAAA,UAC5B,EAAE,GAAG,MAAM,aAAa,GAAI,kBAAkB,EAAE,QAAQ,gBAAgB,IAAI,CAAC,EAAG;AAAA,UAChF;AAAA,QACF;AACA,+BAAuB;AAAA,MACzB,SAAS,KAAK;AACZ,eAAO,KAAK,2CAA2C,EAAE,aAAa,MAAM,aAAa,IAAI,CAAC;AAAA,MAChG;AAEA,UAAI,sBAAsB;AACxB,YAAI;AACF,gBAAM,EAAE,uBAAuB,IAAI,MAAM,OACvC,uDACF;AACA,gBAAM,EAAE,sBAAsB,IAAI,MAAM,OACtC,0CACF;AACA,gBAAM,MAAM,MAAM;AAAA,YAChB;AAAA,YACA;AAAA,YACA;AAAA,cACE,eAAe,WAAW,MAAM,WAAW;AAAA,cAC3C,UAAU,iBAAiB;AAAA,cAC3B,gBAAgB,iBAAiB;AAAA,cACjC,QAAQ,iBAAiB;AAAA,cACzB,WAAW;AAAA,YACb;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,6BAAoB,KAAgC,MAAM;AAAA,QAC5D,QAAQ;AACN,6BAAmB;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAMA,UAAM,UAAU,MAAM;AACtB,UAAM,iBACH,OAAO,QAAQ,aAAa,YAAY,QAAQ,SAAS,SAAS,IAAI,QAAQ,WAAW,UACzF,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,SAAS,IAAI,QAAQ,QAAQ,UAChF,OAAO,QAAQ,gBAAgB,YAAY,QAAQ,YAAY,SAAS,IACrE,QAAQ,cACR;AACN,UAAM,qBACJ,iBAAiB,cAAc,SAAS,GAAG,IAAI,cAAc,YAAY,IAAI;AAM/E,UAAM,uBAAuB,qBAAqB;AAClD,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,0BAA0B;AAAA,QACxC;AAAA,QACA;AAAA,QACA,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,QAAQ;AAAA;AAAA;AAAA;AAAA,QAIR,OAAO;AAAA,UACL,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,eAAe,OAAO,MAAM,MAAM,kBAAkB;AAAA,QACtE;AAAA,QACA,qBAAqB,MAAM;AAAA,MAC7B,CAAC;AAAA,IACH,SAAS,KAAK;AAGZ,UAAI,eAAe,8BAA8B;AAC/C,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,oBAAoB,IAAI;AAAA,UACxB,qBAAqB,IAAI;AAAA,QAC3B;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAQA,QAAI,wBAAwB,MAAM,gBAAgB,WAAW,MAAM,QAAQ;AACzE,YAAM,sBACJ,OAAO,QAAQ,iBAAiB,cAAc,OAAO,QAAQ,mBAAmB;AAClF,YAAM,iBAAiB,MAAM,MAAM;AACnC,UAAI,uBAAuB,gBAAgB;AACzC,YAAI;AACF,gBAAM,EAAE,aAAa,IAAI,MAAM,OAAO,iBAAiB;AACvD,gBAAM,aAAa;AAAA,YACjB,WAAW,IAAI;AAAA,YACf,OAAO;AAAA,cACL,UAAU,MAAM,MAAM;AAAA,cACtB;AAAA,cACA,QAAQ,MAAM;AAAA,YAChB;AAAA,YACA,OAAO,EAAE,WAAW,QAAQ,GAAG;AAAA,UACjC,CAAC;AAAA,QACH,SAAS,KAAK;AAGZ,iBAAO,KAAK,+CAA+C,EAAE,WAAW,QAAQ,IAAI,IAAI,CAAC;AAAA,QAC3F;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,QAAQ,aAAa,WAAW,QAAQ,IAAI,mBAAmB;AAAA,EAC1E;AACF;AAEA,gBAAgB,+BAA+B;AAE/C,IAAO,qCAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/commands/deliver-outbound-message.js

@@ -169,7 +169,7 @@ const deliverOutboundMessageCommand = {
     }
     const credentialsScope = {
       tenantId: input.scope.tenantId,
-      organizationId: input.scope.organizationId ?? input.scope.tenantId,
+      organizationId: channel.organizationId ?? input.scope.tenantId,
       userId: channel.userId ?? null
     };
     let credentials = {};
@@ -251,7 +251,7 @@ const deliverOutboundMessageCommand = {
         credentials,
         scope: {
           tenantId: input.scope.tenantId,
-          organizationId: input.scope.organizationId ?? input.scope.tenantId
+          organizationId: channel.organizationId ?? input.scope.tenantId
         },
         metadata: converted.metadata
       });